I scanned a site using vulnerability scanner and got a CVV score 10 vulnerability. But I haven't hacked into system yet. Should I mail the report to the company?